KR20180076753A - System and Method for Anomaly Pattern - Google Patents

Abstract

A system for sensing an abnormal pattern according to an embodiment of the present technology includes a data vectorization unit for digitizing all data based on word embedding, a time-series modeling unit which performs learning by inputting a time-series data vector or a data vector generated during a predetermined time window of the time-series data vector, and a hierarchical behavior knowledge space processing unit for checking whether the abnormal pattern is sensed based on a modeling result of the time-series modeling unit. Accordingly, the present invention can sense the abnormal pattern with a hybrid method.

Description

{System and Method for Anomaly Pattern}

The present invention relates to anomaly detection technology, and more particularly to an abnormal pattern detection system and method.

The abnormal pattern detection method is a method of finding abnormal data, that is, an abnormal pattern, from data supplied or on-line.

The abnormal pattern detection method is divided into two types: rule-based methodology and neural network-based methodology.

Rule-based methodology is a classical method in which experts analyze statistical rules (ie, "xxx pattern of data appears over 90% for one hour") to analyze and determine the cause of anomalous patterns, Rules (that is, "when YYY data appears in any data field", etc.) are generated and applied to input data to find an abnormal pattern.

The rule-based methodology can explain the cause by using the applied rule when the abnormal pattern appears, and it is easy to add the new rule to the system, but it is necessary that the expert on the problem area generates the rule. In addition, in the case of statistical rules, since more than a certain amount of data is required to obtain meaningful statistics, real-time abnormal pattern detection is impossible. In addition, due to the noise (error) inevitably appearing in the data, there are many exceptions in the rule application, which is difficult to use practically.

A neural network based methodology is a methodology that detects abnormal patterns from data by using a non - cooperative learning method or a learning method with an auto encoder configuration using input data as output data.

Since the neural network based methodology models the data through the learning process, it does not need time to obtain statistics on the data in the actual monitoring situation, and it is possible to detect the near ideal pattern in real time and to relate the noise (error) . However, when an abnormal pattern appears, it is necessary to analyze the actual data of the experts in order to explain the cause, and it is necessary to adapt the learning of detecting the abnormal pattern in real time to the system, Learning methodology has not yet been put into practical use.

The data fed for detection of anomalous patterns can be divided into time series data in which the order of inputting data into the system is important and spatial data independent of the order. In addition, one data is composed of a set of data fields, and each data field is composed of numerical data having a meaning of a value (metric) (size, distance) and non-numerical data indicating a kind, Can be divided.

In this case, non-numerical data is inappropriate for use as an input of a numerical neural network since the metric of the data value is meaningless.

Therefore, non-numerical data must be converted into numerical data (vectorization, vectorization). Also, since unseen data may appear in the training data, it should be able to be processed in this case as well.

Embodiments of the present technology may provide a system and method for detecting anomalous patterns in a hybrid manner by applying a variation of a neural network-based method and a rule-based method, for example, a Hierarchical Behavior Knowledge Space (HBKS) method .

Embodiments of the present technology can provide a method of digitizing using a word embedding method and an abnormal pattern detecting system and method capable of processing unseen data.

The abnormal pattern detection system according to an embodiment of the present invention includes a data vectorization unit for digitizing all data based on word embedding; A time series modeling unit for performing learning by inputting a time series data vector or a data vector generated during a predetermined time window among time series data vectors; And a hierarchical action knowledge space processing unit for checking whether an abnormal pattern is detected based on a modeling result of the time series modeling unit.

According to the present invention, it is possible to detect anomalous patterns by a hybrid method that integrates a neural network-based method and a rule-based method.

This technology can be applied to various abnormal pattern detection such as fraud detection, prognosis, DRM risk monitoring, network intrusion monitoring, and the like of a financial institution.

1 is a block diagram of an abnormal pattern detection system according to an embodiment of the present invention.
FIG. 2 is a view for explaining the concept of statistical vector computation according to an embodiment.
3 is a flowchart illustrating an abnormal pattern detection method according to an exemplary embodiment of the present invention.

Hereinafter, embodiments of the present technology will be described in more detail with reference to the accompanying drawings.

1 is a block diagram of an abnormal pattern detection system according to an embodiment of the present invention.

Referring to FIG. 1, the abnormal pattern detection system may include a data vectorization unit, a time-series modeler, and a hierarchical behavioral knowledge space (HBKS) processor.

1. Data

The data vectorizer may be configured to digitally represent all data by applying word embedding.

The data vectorization unit will be described in more detail as follows.

First, a data field filtering process for selecting data fields necessary for detecting an abnormal pattern among the entire data fields can be performed.

A data field can be divided into a set of data fields having non-numerical values and a set of data fields having numerical values, and can be divided into non-numeric data and numerical data for each data.

<Example> (sex, height, weight, marital status) -> (gender, marital status), (height, weight)

The set of numerical data fields can be normalized to a certain extent for the entire data set for each data field.

<Example> Normalizing the height data between 0 and 1

In addition, one non-numeric data instance for a set of non-numeric data fields can be represented as a one-hot vector.

0, 0, 0), (0, 0, 1, 0), (0, 0, 0, 1)

In this case, in the case of non-numeric data field values that are not in actual data for vectorization of unseen data, all cases can be generated and added to the data set.

Example: If the data set contains only (0, 0, 0, 0), (0, 1, 0, 0)

In addition, word-embedded learning can be performed in order of non-numeric data to reflect the time series. At this time, in case of unseen data, word embedding learning can be performed by 0 vector, unseen vector, and 0 vector.

As a result, a vector representation of a particular dimension can be obtained for all non-numeric data field instances. Then, the obtained vector expression can be normalized to the normalized range of the numerical data.

Next, the numerical data field and the non-numeric data field are concatenated, and the result of the concatenation can be defined as a "data vector".

If the entire data vector is numerical data, all or some of the dimensions (data fields) may be expressed as non-numeric data and used as the BKS key data of the corresponding data. Also, it can be selected from ellipses with large change between data through Principal Component Analysis (PCS).

<Yes> (+, smaller, Yes) in (0.7, -2, 1) => ({+, 0, -}

2. Time Series Modeling Unit

The time series modeling department Domain (Domain) Depending on the nature and amount of data, a neural network model suitable for time series modeling can be applied.

In one embodiment, the time series modeling unit may be configured using a recurrent neural network, a self-organizing map, or the like using non-bipartite learning, or an auto-encoder model using map learning can do.

In the time series modeling unit, the input data may be a time series data vector obtained from the data set in the data vectorization step, or a data vector generated during the predetermined time window W among the time series data vectors.

V (t), v (t-1), and v (t-2), where W = 3 and the vector of time t is v (t). If t <W, then v (t) is a 0 vector (vector with the highest entropy)

3. Hierarchical Behavior Knowledge Space (HBKS)

Hierarchical Behavior The knowledge space processing unit can be configured to store an abnormal pattern in the system during the data monitoring process and to apply it to the monitoring process afterwards. In addition, the hierarchical action knowledge space processing unit can store the cause of the abnormal pattern together and explain the cause of the same pattern in the future.

Hierarchical Behavior Before describing the knowledge space processing unit, we describe the Behavioral Knowledge Space (BKS).

BKS is basically a set of "BKS elements".

BKS = {BKS element}

The BKS element may be a pair of key data and a statistic vector corresponding to the key value of the database.

BKS element = {(key data, statistic vector)}

The key data is one of data to be observed and may mean input data of data vectorization. The statistical vector may be a two-dimensional vector (the number of times the key data is referenced, the number of times the corresponding key data is determined as an abnormal pattern).

The significance level threshold implies that the BKS judgment is believed to be "if the BKS has been referred to more than a certain number of times with the threshold value of the" reference number of the key data ". For example, "significance level threshold = 30 ".

The confidence rate can be expressed as b / a, a! = 0 if the statistical vector is (a, b) with "probability that the key data is actually an abnormal pattern".

A BKS search means that in a given BKS, the key data looks for a BKS element that matches the given data, and if so, the corresponding BKS element is output.

Generating a BKS means creating a BKS element with the given data as the key data in a given BKS, where a statistical vector V can also be generated. For example, if an abnormal pattern is V = (1,1), and if it is not an abnormal pattern, V = (1,0).

BKS element update means that V = (a + 1, b + 1) for an ideal pattern and V = (a + 1, b) for a statistical vector with given data as key data. It means updating together.

The HBKS will be described below.

Considering an ordered set of W key data, it can be mapped to a word of length W one by one, and one key data can correspond to one alphabet.

KD2 => 'A', KD3 => 'N', KD1 => 'M'

Considering a small ordered pair of length w in a given ordered pair when 1 <= w <= W, this can be represented by a sub-string of words of length W.

<Example> MAN => "M", "MA", "MAN"

A BKS having key data of concatenation of a data sequence pair of length W for a given data set is conceivable, and a BKS having key data of length w (1 <= w <= W) is also conceivable.

Once the data set and W are determined as above, we can think of a BKS of length w (called "w-BKS") and define these collections as HBKS of the given dataset.

Also, the key data of HBKS is connected by TRIE structure.

A leaf node (i.e., each node of the W-BKS) may have a store that can store a description of why it is anomalous if the corresponding data field appears.

The HBKS search refers to searching for a key length of W in a given HBKS, and if so, outputting the corresponding HBKS element.

HBKS generation means generating an HBKS element having the given data as the key data in a given BKS, and can also generate the statistical vector V of each t-BKS.

The t-BKS may be updated step by step according to the HBKS element update procedure.

The HBKS processing unit will be described in more detail as follows.

An example of defining HBKS for learning data of length W will be described as follows.

If a time window of a time series data vector is not determined, such as a recurrent neural network, W can be arbitrarily set to any value from 1 to a large number.

The key data means an ordered pair corresponding to W data vectors observed at a specific time.

<Example> Assuming that W = 5 and t = 3

The key data of 5-BKS is (V3, V2, V1, 0 vector, 0 vector)

The key data of 4-BKS is (V3, V2, V1, 0 vector)

The key data of 3-BKS is (V3, V2, V1)

The key data of 2-BKS is (V3, V2)

The key data of 1-BKS is (V3)

The statistic vector is a statistical vector for the corresponding key data and can be calculated according to a TRIE structure as shown in FIG.

The learning method for the learning data in the HBKS processing unit is as follows, for example.

After completing the time series modeling on learning data. It is possible to set a general abnormal pattern occurrence rate (eg detection rate 0.1%). Then, the neural network abnormal pattern detection threshold (THD) can be set in accordance with the detected detection ratio. For example, if the learning data is 1,000,000 and the abnormal pattern occurrence rate is 0.1%, the threshold THD at which 1,000 patterns are detected as abnormal pattern candidates can be set.

HBKS can be set for the detected abnormal pattern candidate. In this case, the initial setting can be set to "Not an abnormal pattern".

3 is a flowchart illustrating an abnormal pattern detection method according to an exemplary embodiment of the present invention.

Referring to FIG. 3, when data of time t is obtained, data field filtering can be performed. When the previous data is prepared, it is judged whether it is an abnormal pattern based on the HSBK search condition.

If it is an abnormal pattern, it informs it. If it is not an abnormal pattern, it vectorizes the data and applies a time series model. In addition, it is checked whether the abnormal pattern detection threshold value THD is exceeded. If the threshold value is exceeded, the process goes to a step of notifying that an abnormal pattern has occurred. Otherwise, the process returns to the initial step.

The HSBK search conditions shown in FIG. 3 will be described in detail as follows.

first. The time series data of length W is searched for HBKS.

The time series vector is searched in w-BKS from w = 1 to w = W.

If the search result is not found, it passes as it is, and if it is found, the following process can be performed.

- If a of the statistical vector is above the significance level and the abnormal pattern rate (b / a) is above the confidence rate, the abnormal pattern is output. If the final leaf node has a description of the cause,

- If a is less than the significance level threshold and the abnormal pattern rate (b / a) is more than the confidence rate,

- If a is less than the significance level threshold and the abnormal pattern rate (b / a) is less than the confidence rate, it is output as a normal pattern candidate.

- If a is greater than the significance level threshold and the abnormal pattern rate (b / a) is less than the confidence rate,

On the other hand, HBKS can be updated by expert reviews.

For example, HBKS search / generation / update can be done according to the result after expert review on patterns that need expert review of pattern in HBKS or detected as abnormal pattern through neural network model.

At this time, according to the judgment after the expert's review, it is necessary to adjust a to the significance level threshold or more so that the abnormal pattern rate (b / a) or the normal pattern rate (ab / a) And b can be adjusted to a minimum and then the entire HBKS can be modified accordingly.

<Example 1>

W = 5, significance level threshold 30, confidence rate 95% (a, b) = (11, 5)

(11 + 19, 5), the normal pattern rate is increased to a (a-b / a) above the confidence rate

<Example 2>

W = 5, significance level threshold 30, confidence rate 95% (a, b) = (11, 5)

(11 + 19, 5 + 19), and a and b are increased until the ideal pattern rate (b / a) becomes more than the confidence rate

Once the entire HBKS has been modified, the cause can be saved to the corresponding leaf node.

As described above, in the present technology, the non-numerical data is vectorized by applying the word embedding method, thereby effectively reducing the data dimension and improving the generalization ability of the modeling result. The non-numeric data can be vectorized by referring to the immediately preceding data and the immediately following data to reflect the time constant.

It is also possible to organically combine rules and neural network learning results based on empirical knowledge of experts using HBKS.

If an abnormal pattern appears, the cause can be explained by using the applied rule (only when the abnormal pattern is stored in HBKS, if the pattern is not stored in HBKS, it is necessary to analyze the cause as in the case of the existing neural network method).

It is possible to register an anomaly pattern according to the judgment of the expert (user) in the system and immediately apply from the next detection. If there is a policy for the detection accuracy (for example, the false rate is less than 5%), It can be statistically converged to the target value.

This technology is also based on neural network method, so it is possible to detect near-ideal pattern in real time and is relatively strong against noise (error) inevitably appear in data.

In addition, a combination of data values not included in the data set in the data vectorization can be included in the vectorization, so that it is possible to monitor all combinations of data values.

Thus, those skilled in the art will appreciate that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. It is therefore to be understood that the embodiments described above are to be considered in all respects only as illustrative and not restrictive. The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

Vectorizer: The data vectorizer
Time-series Modeler: Time series modeling part
HBKS: hierarchical behavior knowledge space processing unit

Claims (21)

Determining whether there is an abnormal pattern by referring to the statistical data when there is key data corresponding to the received data field, and if there is no key data corresponding to the received data field Wherein the controller is configured to time-series model the received data field to determine whether an abnormal pattern exists. The method according to claim 1,
Wherein the abnormal pattern detection system is configured to vectorize the received data field and then time-series model the received data field. The method of claim 1,
Wherein the abnormal pattern detection system is configured to perform the time series modeling using any one of a recurrent neural network model, a self-organizing map model, and an auto encoder model. The method according to claim 1,
Wherein the abnormal pattern detection system is configured to update the database when it is determined that the abnormal pattern is an abnormal pattern. A rule-based detection processing unit configured to determine whether an abnormal pattern is based on a rule for a received data field;
A vectorization unit for vectorizing the received data field to generate a data vector;
A neural network based sensing processing unit configured to receive the data vector and determine whether the pattern is abnormal based on a neural network; And
A database for referring to, generating and updating information on a data field determined as an abnormal pattern by the rule-based detection processor and the neural network-based detection processor;
The abnormal pattern detection system comprising: 6. The method of claim 5,
Wherein the rule-based detection processing unit is configured to reflect information on a data field determined as an abnormal pattern in the neural network-based detection processing unit to the database. 6. The method of claim 5,
Wherein the rule-based detection processing unit is configured to include a hierarchical action knowledge space processing unit. 6. The method of claim 5,
Wherein the rule-based detection processing unit is configured to notify that the abnormal pattern is an abnormal pattern and to output a description of the cause if the abnormal pattern is determined. 6. The method of claim 5,
Wherein the rule-based detection processing unit is configured to notify that an abnormal pattern is displayed and that an administrator or an expert needs to be determined if the abnormal pattern candidate is determined. 6. The method of claim 5,
Wherein the vectorization unit is configured to quantize all of the received data fields in time series. 6. The method of claim 5,
Wherein the vectorization unit is configured to generate a data vector in all cases for non-numeric data of the received data fields. 6. The method of claim 5,
Wherein the vectorization unit is configured to represent all or a part of the received data field as non-numeric data when all of the received data fields are numeric data. 6. The method of claim 5,
Wherein the database is configured to store key data and statistic vectors corresponding to data fields judged as abnormal patterns. 6. The method of claim 5,
And a filtering unit for receiving and filtering data, which is a set of at least one data field, and providing the data to the rule-based detection processing unit and the vectorization unit. A rule-based determination step of determining whether the received data field is an abnormal pattern based on a rule;
Generating a data vector by vectorizing the received data field if the result of the determination is not an abnormal pattern;
A neural network-based determination step of receiving the data vector and determining whether an abnormal pattern is based on a neural network; And
Storing information on a data field determined as an abnormal pattern as a result of the rule base and the neural network;
And detecting the abnormal pattern. 16. The method of claim 15,
Wherein the rule-based decision step is performed by a hierarchical action knowledge space method. 16. The method of claim 15,
Wherein the vectorization unit is configured to digitize all of the received data fields in time series. 16. The method of claim 15,
Wherein the vectorization unit is configured to generate a data vector in all cases for non-numeric data of the received data fields. 16. The method of claim 15,
Wherein the vectorization unit is configured to represent all or a part of the received data field as non-numeric data when all of the received data fields are numeric data. 16. The method of claim 15,
Wherein the neural network based sensing processing unit is configured to include a time series modeling unit. 16. The method of claim 15,
Wherein the storing step includes storing key data and a statistic vector corresponding to the data field determined as the abnormal pattern.

Images